CVE-2026-22665 describes a CWE-178 vulnerability in prompts.chat where inconsistent handling of case sensitivity in username processing leads to identity confusion. Specifically, the system treats usernames case-sensitively during write operations but case-insensitively during read operations, allowing attackers to register usernames that differ only by case and bypass uniqueness checks. This non-deterministic username resolution enables attackers to impersonate legitimate users, overwrite profile content on canonical URLs, and inject malicious metadata and content platform-wide. The vulnerability affects all versions prior to commit 1464475. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows attackers to impersonate other users by registering case-variant usernames, potentially leading to unauthorized access to user profiles and content. Attackers can replace legitimate profile content on canonical URLs and inject attacker-controlled metadata and content, undermining platform integrity and user trust. This can facilitate further attacks such as social engineering or misinformation. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users and administrators should monitor vendor communications for updates. Until a fix is available, consider restricting username registration policies to enforce consistent case handling or implement manual review processes to detect suspicious case-variant usernames.